Data model / ontology for supply chain security (GUAC-aligned)

[mlieberman85]

Summary

darnit-baseline produces OSPS Baseline audit results and (feature 025) attestations bound to control verdicts. To take this work "to the next level" we want darnit's outputs to speak the same ontology the broader supply-chain security ecosystem speaks -- primarily GUAC (Graph for Understanding Artifact Composition, CNCF Incubating), which is the closest thing to a lingua-franca for supply-chain relationship graphs today.

The goal is interoperability: darnit-produced evidence should be ingestible by GUAC (and, downstream of GUAC, by SLSA verifiers, SBOM consumers, VEX aggregators, etc.) without a bespoke adapter per consumer.

Scope (research + design first)

• Survey GUAC's ontology (nodes: Package, Source, Artifact, Builder; edges: IsDependency, HasSBOM, HasSLSA, HasSourceAt, CertifyBad, CertifyGood, CertifyScorecard, CertifyVEX, HashEqual, PointOfContact, ...).
• Map darnit-baseline's evidence shape onto GUAC vocabulary. Likely mapping:
  • OSPS control verdicts -> Certify* predicates (PASS = CertifyGood, FAIL = CertifyBad, WARN = neither).
  • Feature 025 attestation predicates -> in-toto statements GUAC already understands via HasSLSA / attestation nodes.
  • .project/ metadata -> PointOfContact + Source relationships.
• Identify the gaps: things darnit says that GUAC has no vocabulary for (e.g., WARN / INCONCLUSIVE authority), and things GUAC expects that darnit doesn't emit today.
• Propose a data model (Pydantic or JSON-Schema) that darnit-baseline emits alongside (or in place of) its existing evidence shape.

Non-goals for the research phase

• Building the GUAC ingestion adapter itself (that's a downstream feature once the model lands).
• Mapping to other supply-chain graph tools (Sigstore Bundle graph, in-toto Grafeas, OSV.dev) as first-class -- surveying is fine; adapters can follow.
• Redefining the OSPS Baseline predicate (that's an upstream OSPS conversation, not darnit).

Deliverables

• A docs/research/supply-chain-ontology.md (or a spec-kit spec) with:
  • GUAC vocabulary tour.
  • darnit -> GUAC field mapping table.
  • Gap analysis (what darnit says that doesn't fit; what GUAC expects that darnit doesn't emit).
  • Recommendation: emit a new shape? Extend existing evidence? Ship a GUAC-adapter service?

Constitution alignment

• Data-model work; touches Principle V (Sieve Pipeline Integrity) indirectly if the pipeline's output shape changes. Any actual output-shape change is out of scope for this issue and requires its own spec.

Related

• Feature 025 (RFC-0001 Stage 1 authority + attestation).
• Datastore backend for project metadata (alternative to .project/) #391 (Datastore for project metadata) -- adjacent formalization of the same-source data being emitted.